Everything you need to know about ICANN's new transfer policy

Latest update: December 1, 2016

On December 1, 2016, ICANN started enforcing a new transfer policy that modifies the process of changing domain ownership from one registrant to another. The implementation of the policy is imposed on all registrars. We have created this resource page to ensure that all OpenSRS resellers are ready for this policy. We encourage you to review this policy update to familiarize yourself with all of the changes that are being made to the transfer policy.

What is this policy?

The policy we are discussing here is the Transfer Policy, formerly known as “Inter-Registrar Transfer Policy” or IRTP. Up until now, this policy only covered domain transfers between registrars (it’s the policy that mandates the Forms of Authorization to be completed by a registrant prior to a transfer). The new policy also covers the process of changing ownership of the domain from one entity to another (registrant to registrant). Every time a change of registrant takes place, the policy is called upon and a series of confirmation and approval emails are triggered. What’s important to note is that simple updates to a registrant’s first name, last name, organization and email address on a particular domain also triggers the same slew of notification and confirmation emails.

When is it going into effect?

The new transfer policy is effective on December 1, 2016.

New transfer policy timeline

We have been working actively on the implementation of this policy. The timeline below will give you an indication of how the work is progressing.

How will it impact your business?

Once the policy is in effect, the impact on resellers and their end users will be visible. It can be summarized as follows:

It will no longer be possible to change the registrant of a domain name with a simple domain modification request.

Any changes to first name, last name, organization or email address fields for the owner of any gTLD domain name will now start a trade process.

The process involves obtaining explicit confirmation from current and new registrants before a change can be completed.

After a change of registrant has been completed, previous and new registrant will receive a confirmation notice informing them that the change has completed

After a change of registrant has been completed, the domain is by default locked for transfers to a new registrar for the following 60 days

What is OpenSRS doing?

At OpenSRS, we believe that the ICANN community who came up with this new policy did a disservice to registrants. The policy requirements do not add any positive element to the experience of managing a domain name, and there has been no consideration how this policy would align with the number of other ICANN mandated policies which are already in place. Nonetheless, OpenSRS is, like all other ICANN accredited registrars, bound by the terms of the Transfer Policy, and needs to follow due process.

Our approach in implementing this policy is:

To design the required processes in a way that meets policy terms and withstands an ICANN audit.

To minimize the actual negative impacts for resellers and end-users.

To leverage policy options such as the “Designated Agent” or transfer-lock opt-outs to streamline the process and reduce registrant impact as much as possible.

Our approach is to ensure resellers do not necessarily need to make adjustments to their systems to support the new policy. OpenSRS will be able to handle all necessary basic requirements, and provide some optional tools and features that allow resellers to optimize handling of this policy.

How does the new process work?

The process starts with the reseller submitting a request to modify the owner of a given domain name.

OpenSRS will then check if the New Registrant has previously accepted Tucows to act as a Designated Agent (DA). If so, OpenSRS would auto-approve the change for the New Registrant. Otherwise OpenSRS will send an email to the New Registrant, asking them

to approve or decline the Change of Registrant,

to confirm that their information is correct (as per Registrant Verification), and

accept Tucows to act as a Designated Agent for all future changes of registrant (optional)

Once the change has been approved by the New Registrant, OpenSRS will check if the Prior Registrant has accepted Tucows to act as a DA. If that is the case, OpenSRS would auto-approve the change for the Prior Registrant. Otherwise, OpenSRS will send an email to the Prior Registrant, asking them

to approve or decline the Change of Registrant, and

opt out of the 60-day registrar transfer lock after a Change of Registrant (optional).

After both approvals have been recorded, OpenSRS will complete the Change of Registrant and send a final confirmation to both Prior and New Registrant which notifies them about the completed process. In this scenario, the New Registrant will not receive a subsequent email to complete the Registrant Verification process, as this has already been completed with the initial confirmation.Even if the email of Prior and New Registrant is the same, the policy requires OpenSRS to send two separate emails. There is no further response required from registrants at this point of the process.

In case the New or Prior Registrant decline a change, or the request times out after 7 days, the entire process is aborted, and the present owner details will stay in place.

To help you better understand how this works, we have simplified the new process into five likely scenarios that may apply to all resellers. Please note: our systems will accommodate all scenarios.

New Registrant uses Tucows as Designated Agent

Old Registrant uses Tucows as Designated Agent

New Registrant doesn’t use Tucows as Designated Agent

Old Registrant uses Tucows as Designated Agent

New Registrant uses Tucows as Designated Agent

Old Registrant doesn’t use Tucows as Designated Agent

New Registrant doesn’t use Tucows as Designated Agent

Old Registrant doesn’t use Tucows as Designated Agent

End User buys a domain from someone using another registrar and transfers to Tucows

Preparing for the new policy

1) Make sure you present our updated Registration Agreement to all your new and existing customers whenever they submit a domain-related request.

3) To ensure that emails sent to current and new registrants reflect your language and brand, we have added and translated three new templates to our messaging platform:
• Change of Registrant Confirmation for New Registrant
• Change of Registrant Confirmation for Current Registrant
• Notification for Completed Change of Registrant

4) Change the link colours and add a custom URL for your confirmation pages under brand settings within the Reseller Control Panel. If you haven’t uploaded your logo yet, now is a good time to do so. IMPORTANT: confirmation pages will be shown in the same language as the Change of Registrant emails.

What is a Designated Agent in the context of this policy?

The Transfer Policy allows Registrants to delegate giving their consent to a Change of Registrant to a third-party on their behalf. The policy defines such third-party as a Designated Agent (DA):

1.2 “Designated Agent” means an individual or entity that the Prior Registrant or New Registrant explicitly authorizes to approve a Change of Registrant on its behalf.

In practical terms, this means that a Registrant can give authority to Tucows (the legal entity that operates the OpenSRS registrar) to confirm a Change of Registrant. When Tucows is enabled to act as a Designated Agent, the Registrant will not need to receive or confirm an email in order for a change to proceed. Instead, Tucows will always auto-approve any Change of Registrant.

In order to support this option, Tucows has made a change to its Registration Agreement, which is the legal document that each and every Registrant has to accept in order to manage a domain name through OpenSRS. In this agreement, we have added the following language:

TRANSFER OF OWNERSHIP. […] Registrant explicitly authorizes Tucows to act as their Designated Agent, as stipulated by the ICANN Transfer Policy, to approve a Change of Registrant on their behalf.

As a reseller, you are required to incorporate all provisions of this agreement in the agreement with your customer, so we advise to update your agreement to the latest version. We may be required to provide evidence to ICANN that your customer has actually accepted those terms, including your customer’s timestamp and IP at the time acceptance.

How can I enable the Designated Agent option for my reseller account?

We will provide you with an option in the Reseller Control Panel to confirm that you meet all the legal requirements. Specifically, we will ask you to confirm the following:

You have incorporated the Tucows Registration Agreement in its latest version into the contract with your customer/domain registrant. The latest version includes a provision for the registrant to accept Tucows as Designated Agent.

You are requesting a domain registration or transfer at OpenSRS only after the registrant has entered into such agreement.

You can present proof, upon future request, that a registrant of a specific domain has accepted a contract that binds them to our Registration Agreement. Proof could be a timestamp log (e.g. 3:00UTC, date: 21/2/13, domain: example.com, registrant: John Doe, registrant IP: 122.111.222), a copy of a written and signed contract, or a screenshot of an Executed Agreement for the domain including domain name, registrant, and date/time of execution). We will ask you for this information if ICANN requests us to present this during an audit.

Once you have confirmed this, we will mark all registrants of existing domains in your reseller account as having accepted Tucows as their Designated Agent for the Transfer Policy.

What is the process if both the New and the Prior Registrant have accepted Tucows as a Designated Agent?

In this case, the entire process completes immediately without Registrant approvals required. Both Prior and New Registrant will receive a notification about the completed change. The New Registrant will subsequently receive an email request to complete the Registrant Verification process.

What happens if the current registrant email is invalid or not accessible?

If a confirmation email sent to the New or Prior Registrant bounces, or it is no longer accessible, the reseller will have the opportunity to resend the confirmation request

to the same email address (if the bounce was just temporary), or

via SMS to the phone number supplied for the Registrant.

If the phone number is incorrect, the reseller has the option to update the current registrant details with a new, valid mobile phone number. Updating just a registrant’s phone number is not considered a change of registrant by the Transfer Policy, so OpenSRS will process this update without confirmation. Once the phone number is correct, the reseller can then resend the confirmation email to the new, updated phone number.

How will I know if my request has timed out or has been denied? How will I know when the change is “approved” by the prior and new registrant contact?

A setting will be available in the Event Notifications Tab (In the Reseller Control Panel) to enable either a poll and/or email message notification. Tucows will also introduce a new, internal status that we’ll make available to Resellers

Questions our resellers have been asking

Q: Where do I find details about the new APIs that OpenSRS is providing for this policy?A: We have added documentation for the additional API calls to our online API documentation available at domains.opensrs.guide. Please see the “ICANN Trade” section for all new API commands.

Q: Should I make the New Registrant accept the Designated Agent option on my own portal? Does it make the process a lot easier?A: The short answer is, we give you option to do so, but a New Registrant will still receive a confirmation email.

The Transfer Policy requires every New Registrant accept our Registration Agreement during the process, which has the provision for Tucows to act as a Designated Agent. Resellers have the option to collect the New Registrant’s acceptance of our agreement on their end – for example once your customer is logged in at your portal and clicks a checkbox before they submit the Change of Registrant request. OpenSRS provides an API that enables resellers to set the New Registrant having accepted Tucows as a Designated Agent before you initiate the actual Change of Registrant process. View documentation. In this case the New Registrant would not receive a Change of Registrant confirmation email.However, even in this scenario the New Registrant will still receive a Registrant Verification email after the Change of Registrant has been completed. Otherwise, if the New Registrant has not accepted our Registration Agreement prior to submitting the change, we will complete the Change of Registrant confirmation and Registrant Verification process with a single email being sent.

So either way, the New Registrant will be required to confirm one email, and will receive a notification for the completed Change of Registrant.

Q: Is it correct that once a Registrant accepts Tucows as Designated Agent (DA), the Registrant itself has no way to revert this decision, and only the reseller can disable the DA setting? A: This is correct. Only the reseller can revert the DA setting on behalf of a Registrant via a specific API. View documentation

Q: Will a Current Registrant be able to accept Tucows as a Designated Agent when confirming a Change of Registrant?A: A Current Registrant would receive a confirmation email only in a scenario where they haven’t accepted Tucows as their Designated Agent yet, or their reseller has disabled that setting for them. For this scenario, we have decided against giving the Current Registrant the option to accept Tucows as the DA, as generally they will soon no longer be the registrant at all. While theoretically they still could be a registrant for other existing or future names, it would be difficult to understand this scenario to the user exposed to the confirmation page.

Q: Consider the following scenario:Alice as a New Registrant approves a Change of Registrant and accepts Tucows as a DA. The change completes, and the domain is transfer-locked for 60 days.

5 days later, Alice changes ownership of the domain again to Bob as the New Registrant. Bob as the New Registrant accepts the change.As Alice has previously accepted Tucows as the DA, OpenSRS will auto-approve the change for Alice as the Current Registrant, without giving Alice the chance to opt-out of the transfer lock.

Is there any way for Alice to still opt-out of the transfer lock? And if there is, will she be able to override the transfer-lock setting from the previous transfer?A: It is correct that in this scenario Alice would not receive a confirmation email which would allow her to opt-out of the transfer lock. However, as a reseller you can give Alice the option to opt-out of the transfer lock in your portal at the time when she changes the registrant to Bob. OpenSRS provides an API to modify the transfer lock setting prior to submitting a Change of Registrant. View documentation
If Alice opts out of the transfer lock, her choice will override the transfer lock that was applied from the previous Change of Registrant, and the domain will not be locked after the change has completed.

Q: As all our existing registrants will have accepted the registration agreement, Tucows will be the Designated Agent and auto-approve Change of Registrant requests for them as the Current Registrant. Due to the auto-approve, they will not have the option to opt out of the transfer-lock. Does this mean that in this scenario the transfer lock will apply to all domains coming out of a Change of Registrant process?A: Yes, all Current Registrants who have accepted Tucows as DA will not get a confirmation email, so by default the transfer lock will apply to them. Resellers who want to give their customers the option to transfer the domain away to another registrar anytime after a change can do so by implementing the modify_trade_lock_setting API. View documentation

Q: Why do I need to submit a domain name when setting the Designated Agent option for an existing registrant via the modify_trade_lock_setting API? Doesn’t the Registrant accept the Registration Agreement for all domains they own?A: We ask for the domain name as a simple way to specify which registrant has accepted the Registration Agreement. When you use that API, OpenSRS will look up the owner contact of the given domain and set the “DA accepted” option for the specific firstname, lastname, organization, email combination found in that owner contact. The DA setting will then apply for all existing or future domains that share this unique combination as a Current or New Registrant.

Q: Can I automatically opt-out of the 60-day transfer lock for all of the domains in my reseller account?A: No, the policy does not allow us to provide such setting on a reseller level. The language of the Transfer Policy specifies that only the Registrant themselves can opt-out of the transfer-lock.

Q: What happens if all I do as a reseller is to update the Registration Agreement to include the Designated Agent option, without implementing any technical changes?

A:

Once you confirm that you have updated your registration agreement, OpenSRS will enable the Designated Agent (DA) setting for registrants of all your existing domains.

OpenSRS will automatically enable the DA setting for registrants of all new domains or domains that are being transferred in from another registrar.

When a Change of Registrant occurs, OpenSRS will send out a confirmation email to all NEW registrants, asking them to confirm the change and complete registrant verification in a single step.

Once the New Registrant has confirmed the change, OpenSRS will auto-approve for the Current Registrant and send a notification email to both old and new registrant informing about the completed change.

The domain will be transfer-locked for 60 days

Q: Does this implementation of the new transfer policy also apply to country-code top-level domains (ccTLDs)?A: No, it only applies to generic top-level domains (gTLDs) which are all governed by ICANN policies. ccTLDs usually have their own policies, and are not affected by these changes.

Q: How does this new policy affect using whois privacy on domains?A: We have changed the terms of our Whois Privacy Service to require the registrant to accept Tucows as a Designated Agent. This will allow to enable and disable the whois privacy setting on a domain without going through an email confirmation process. When disabling Whois Privacy, we as the Current Registrant will always opt-out of the 60-day transfer lock, so it will be possible to disable whois privacy just prior to a transfer.

In a scenario where a domain has whois privacy enabled, and the actual registrant is changing, it will follow the usual confirmation process as if whois privacy was not enabled.

Q: Am I able to customize the emails that go out to new and current registrants?A: To ensure that emails sent to current and new registrants reflect your brand, we have added 3 new customizable email templates to our messaging platform:

Change of Registrant Confirmation from New Registrant

Change of Registrant Confirmation from Current Registrant

Notification for Completed Change of Registrant

IMPORTANT:Only the English templates can be modified at this point. Translated templates will be available on November 29th.

Given that the new transfer policy relies heavily on the messaging platform to function, our old messaging platform will be disabled and your account will be automatically migrated to the messaging platform on November 30th. To prevent any loss of customizations, please recreate your messages in the new system. If you are using the messaging platform, you are good to go.

Q: Am I able to customize the confirmation page that new and current registrants will see after they click the emails?A: New branding settings that allow you to customize these confirmation pages will be available in the Reseller Control Panel on November 24th. Confirmation pages will be shown in the same language as the Change of Registrant emails. Translation for confirmation pages will be added on November 29th (alongside translated email templates).

End-user frequently asked questions

As we have stated before, this is a complex policy that has the potential to disrupt your current processes. To help your end-customers understand these changes, we have developed questions and answers. This section will constantly be updated to ensure your customers have the most current information.

Q: What would trigger this change of registrant process?A: Making any change to the first name, last name, organization field, or email within the registrant contact object, will start the process. An approval email will go out to both the old and new registrants.

Q: What happens if it’s not an actual transfer but minor updates to first name, last name, email or organization field?A: At this time, any change to any of those fields will begin the change of registrant process.

Q: Who has to approve the change of registrant request?A: Both the new and the prior registrant need to approve the change of registrant request.

Q: What if I am both the old and the new registrant?A: You will be required to approve the change of registrant request twice.

Q: What happens if the new registrant approves the request but the old registrant denies the request?A: This will cancel the whole request and the whois will revert back to the previous registrant’s info.

Q: What happens if the new registrant denies the request ?A: Then the change of registrant request is canceled and the previous whois info remains the same.

Q: What happens if I am the new registrant and I do not receive the email request to approve the change of registrant?A: Your domain provider will be able to resend the email, otherwise the process will timeout. You will need to start the process again using a different email address.

Q: How long does the new registrant have to approve the request before it expires/times out?A: 7 days from the change request.

Q: What happens if I submit another change of registrant request when one is currently pending?A: The first request will be cancelled.

Q: What if I don’t have access to my old email address?A: Your domain provider can explicitly send a link via SMS to the phone number that they have on file. This will allow you to approve the change of registrant request.

Q: What happens if the number on file is not a mobile phone number?A: Depending on the service we use, we may be able to use features available that can contact registrants at a land line. Otherwise, it is recommended to update the phone number field with a mobile number.

Q: What happens if I buy an aftermarket name, and then the prior registrant does not approve the change of registrantA: Prior to a registrant listing a domain name for sale (at Afternic or Sedo), registrants will be required to appoint Tucows as the designated agent in order to list their names

Q: After a Change of Registrant, are there any restrictions on transferring that name?A: If you want to transfer and change the registrant at the same time, you should transfer the domain first, and then the change the registrant. Failure to do so will result in your domain being locked for 60 days.

Q: Is there anyway to opt out of the 60 day lock after a change of registrant is applied?A: Yes, OpenSRS will offer the prior registrant a chance to opt out of the 60 days transfer lock at the time of the initial Change of Registrant request. This option can be enabled via the End User Control Panel, or through your Domain Provider.